Foo Guard
Menu

MCP Security Scanner

Scan your Cursor, Claude, VS Code, or Continue MCP configuration for exposed credentials, insecure connections, and unpinned launch dependencies. Paste or upload a supported client file directly—no conversion to Foo Guard fields required.

Scan your MCP config →No account required.

Use the configuration you already have

Use strict JSON without comments or trailing commas, or YAML. Nested client settings and unresolved Continue uses imports are not supported. See the native-format documentation for supported structures and limits.

Try a native Cursor or Claude config

This is a complete, synthetic mcpServers file in the supported client format. The package name is a placeholder, not an installation recommendation.

{
  "mcpServers": {
    "example": {
      "command": "npx",
      "args": [
        "--yes",
        "@example/mcp-demo@latest"
      ]
    }
  }
}

Scan this client-file example →

The link loads and scans this example automatically. Its latest package tag triggers AG-028: Unpinned Tool Launch Dependency. Findings keep their paths in the original file. Other findings can identify missing agent metadata or controls that this client file does not declare; a missing field does not prove the client lacks that control at runtime.

What the scan checks

The deterministic rules inspect supported launch declarations, connection settings, and credential-like values. For example, a non-loopback HTTP endpoint can trigger an insecure-connection finding, and an unpinned npx package can trigger a launch-dependency finding. Explicit tool permissions, approval settings, and autonomy fields are also checked when supplied in a supported agent configuration.

Foo Guard does not start servers, execute commands, resolve variables, or read referenced files. Package context for recognized packages is labeled as inferred from documentation; it does not establish observed capabilities or change security scores. The scan does not validate every client setting or prove runtime safety.

Try an MCP launch configuration scan

This complete synthetic assessment input isolates an unpinned package declaration. The package name and version are placeholders, not an installation recommendation. Foo Guard reads the JSON without running the command or contacting the package registry.

{
  "id": "mcp-launch-review",
  "name": "MCP launch review example",
  "owner": "developer-experience",
  "lifecycleState": "development",
  "tools": [],
  "permissions": [],
  "credentials": [],
  "autonomy": {
    "maxIterations": 8,
    "humanApprovalRequired": true,
    "unlimited": false,
    "canModifyOwnConfiguration": false,
    "destructiveOperationsRequireApproval": true
  },
  "auditability": {
    "loggingEnabled": true,
    "tracingEnabled": true,
    "actionAttribution": true
  },
  "mcpServers": {
    "example": {
      "command": "npx",
      "args": [
        "--yes",
        "@example/mcp-demo@latest"
      ]
    }
  }
}

Try this example in the free scanner →

What the example finds

With the full Foo Guard catalog, this example produces one low-severity finding: AG-028: Unpinned Tool Launch Dependency. The latest tag does not declare an exact package version. The security score is 97/100, grade A. A high score can still contain a finding worth reviewing.

A local lockfile may already control package resolution; this static scan does not inspect lockfiles, installed packages, package integrity, or runtime behavior. Package documentation context is separate from rule findings and does not verify runtime capabilities.

Compare an exact-version declaration

Change @example/mcp-demo@latest to @example/mcp-demo@1.2.3. The button below loads the complete counterpart with only that declaration changed. With the current full catalog, it produces no findings and a security score of 100/100.

Scan the pinned example →

For a real server, choose a reviewed version that exists and verify your actual installation process. Editing an assessment does not update the deployed agent. Pinning alone does not prove safety, and a clean configuration scan is not a runtime security guarantee.

Additional explicit configuration checks

The scanner can also review declared HTTP or disabled TLS verification, disabled logging with mutating tools, credentials beyond declared tool needs, and conflicting read-only declarations. Each rule documents its supported fields and limitations.

How this fits the rest of the product

MCP scanning is not a second product. It is the same AI agent security scanner applied to supported MCP client configurations. Repository thresholds still come from .fooguard.yml, and merge blocking still depends on GitHub and CI enforcement.

Supported input is JSON and YAML that Foo Guard can normalize. There is no IDE extension that watches an MCP config as you type, and there is no scheduled re-scan of a running server. When the file changes in Git, scan that revision.

Scan your MCP config